GDPR compliance reviews & documentation

When is this service relevant?

For organisations reviewing their compliance position, preparing for customer due diligence, updating documents or assessing a particular business function.

Scope of support

• Define the scope of the review, the application of the GDPR and the organisation’s roles. Examine documentation and discuss actual processes and data flows with responsible staff.
• Assess purposes, lawful bases, data minimisation, accuracy and retention. Examine the conditions for processing special categories of personal data separately.
• Review how individuals are informed and how their requests are handled. Check whether privacy notices reflect actual processing.
• Assess the parties’ roles, processor selection, contracts, data sharing and the conditions for transfers outside the European Economic Area.
• Review responsibilities, DPIA screening, assessments of new systems and arrangements for responding to personal data breaches.
• Work with responsible staff to examine evidence of safeguards, including access management, deletion, training and other agreed measures.
• Prepare or update records of processing activities (RoPA), privacy notices, internal procedures and agreed templates.
• Provide reasoned findings and an action plan. Distinguish documentation gaps from shortcomings in practice, set priorities and identify information still needed to support conclusions.